sal-anal[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation targeting Solana. The domain sal-anal.pages.dev was created on June 9, 2026, and remains active as of this report. It resolves to IP 172.66.47.104 and is hosted via Cloudflare Pages, using infrastructure typical for rapid deployment and takedown evasion. The page title is 'Solana VM', which directly references the impersonated brand. SSL is issued by Google Trust Services, and technologies detected include React, HSTS, Cloudflare, and HTTP/3. VirusTotal shows 2 of 95 security vendors flagging this domain, and it appears on one security blocklist. Gridinsoft trust score is 0/100, and it is blocked by PhishDestroy. Defenders should treat this domain as actively hostile, block access at the network and email gateway levels, and monitor for related subdomains or sibling domains under the same Cloudflare Pages account. No phishing kit or specific scam category has been identified from available data; the exact page content has not been analysed. Investigators should prioritize reviewing any traffic logs for connections to this domain and correlate with any Solana-branded communications received by users.